Hello Users, I would like to run a design by you. The requirement (and the constraint) is that I have to design a secure communication channel without using certificates. I'm trying out DH key exchange.
My proposed design is a two step process for communication: 1) Use Anonymous DH and estiablish the "shared secret". This is done at some predefined interval - may be once everyday or once every week. 2) In the second step of the communication, we will use the "shared secret" from step 1 for authentication. This will be done using Diffie-Hellman key exchange with pre-shared keys (DHE-PSK, support for which is added in version 1.0.0 ) 3) Once the client is authenticated, all communication is encrypyted using the master secret derived from DHE-PSK. This removes the need for me to establish passwords before two parties can communicate and generates passwords on the fly. Will this secure me against man-in-the-middle attacks which is possible with anonymous DH and without authentication ? Your inputs, suggestions and feedback are much appreciated. BR Ramg
